- [Instructor] Flexible net flow is a Cisco enhancement
that allows for more focused data collection.
The big advantage is that
it allows us to use multiple flow monitors
and exporters on the same traffic simultaneously.
So for example, maybe your security team
wants to monitor traffic for anomalies,
and your infrastructure team simultaneously
is interested in bandwidth utilization,
you could create multiple flow policies
for monitoring the same traffic flows,
but the outputs will be split out
so that each team would only receive the information
that's relevant to their needs.
So rather than capturing everything,
we can get much more specific with Flexible NetFlow.
Here you can see the same topology
as we've used in our previous NetFlow videos,
we have a router connected by gig 0/1,
to the 10.1.1.0/24 subnet,
and we have an external NetFlow collector
sitting at 192.168.10.5.
The three main parts to verify
when we're troubleshooting Flexible NetFlow,
are the flow records,
the flow monitors,
and the flow exporters.
Flow records define exactly what you're going to capture.
So instead of capturing everything,
that's going to let you much more granularly define
the information that's captured by NetFlow.
If we say show run,
we'll pipe to
begin the section flow,
and we'll be able to see our Flexible NetFlow configuration
and our running output.
So the first thing we see here is a flow record.
These flow records define what will be captured.
So again, instead of capturing everything,
this is going to let us be much more granular
in our NetFlow capture.
You can use predefined Cisco records,
or you can create custom user defined records,
which is what we see here.
Whatever is in use,
whether that's the predefined records
or the custom records,
you want to verify that the flow record is configured
to capture your intended information.
We can see that this custom record is named host-record.
And underneath that,
we see a brief description telling us
that this is used to capture custom flow information
for our host traffic
on the 10.1.1.0/24 network.
We can see this record is also configured
with a match command
to match the IP version four destination address.
This will allow us to group our flows
based on the destination IP version four address.
So if your Flexible NetFlow records seem to be
missing information or they seem to be incorrect,
that's an area that you definitely want to double check.
Make sure the match statement is correct.
And just underneath that,
we see the collect keyword
telling us we're going to collect information
related to the interface input for our flow records,
and we're going to attach that information to the flow data.
So again, just to clarify
the difference between match and collect,
the match statement helps to group our packets together
based on certain metrics,
while the collect statement determines which statistics
will be captured and attached
to the flow record.
So both of those things
are very important to verify in your configuration.
Let's jump down
and look at our flow monitor.
The flow monitor is applied to an interface,
and that's going to contain the flow record
that identifies what traffic is matched, and collected.
We see this also has a description,
this one by the way, is named host-monitor,
we see the description underneath that
telling us that this is used with
the flow record host-record.
So that correlates
to the flow record that we just looked at.
So that's what we would expect to see.
The last line in this configuration,
is record host-record.
And this tells us
that we have associated our custom flow record
with this custom flow monitor.
This is going to send our information
to the flow monitor cache,
where it will then be exported to a collector.
So you want to make sure
that your flow record
is correctly identified here.
If this flow record name was incorrect,
if it did not match what we see up here,
then that's going to fail.
And the final piece is the flow exporter
which we see here.
This is named host-export,
and is pointing to a destination IP address of 192.168.10.5
which is of course
our external NetFlow collector in this topology
and we see that that is using UDP port 5000.
So that IP and port
designation is critical to make sure you have communication
with your NetFlow collector.
Let's run through a few more show commands
for troubleshooting,
let's break out of this
and let's say show flow monitor,
and this is going to verify
which flow record we have applied.
Which here we see is host-monitor.
We can also see active and inactive timers
listed at the bottom of that,
we see the cache size as well,
and we see the type.
The type here is set to normal.
Now a normal type flow monitor
will export based on the timers that we see in this output,
it will export when the cache is full,
or when the TCP connections close or reset.
All of those conditions
that we discussed in our previous video.
This type can also be set to either
immediate or permanent as opposed to normal.
If you see the type set to immediate,
this means that the cache is going to expire
as soon as the packet arrives
and it's going to export one packet at a time immediately.
Now, this could potentially saturate your network link,
so that's pretty unusual to use in production,
and that's something to examine in your show output.
A permanent cache
if you saw the type set to permanent,
that means that it's never going to delete
the local cache information.
But it will still only hold a limited amount of information.
So when that cache gets full,
no new flow records would be recorded
and you would receive a message stating
flow is not added in your cache statistics output.
So that's another type that is rarely used.
Under most normal circumstances,
you do want to see
the normal type cached being used here.
We can also say show flow interface,
and we can make sure that Flexible NetFlow is enabled
on a specific interface.
In this case,
we see it is enabled on gigabit 0/1,
which of course is pointing to our host subnet,
so that's good.
Flexible NetFlow only collects data
when it's enabled on an interface.
So if we have all of our configuration in place,
but we haven't enabled that on a particular interface,
that's not going to work.
So definitely double check the flow interface assignment.
And we can say show flow exporter,
followed by the name of our exporter,
which was host-export,
we learned that from our running config output.
Even though we're using Flexible NetFlow,
we are required to choose a version
even with Flexible NetFlow.
So we can see
that this is using version nine.
Again, want to make sure that matches
your NetFlow collectors capabilities.
And we see the destination IP address
which is the NetFlow collection server
192.168.10.5,
we also see the destination port set to 5000.
So that's a look at troubleshooting
Flexible NetFlow in Cisco IOS.